Operation LINDEN 


Unsolicited Marketing Communications Strategy Meeting 


EXTERNAL VERSION 


Location: 30 Euston Square, Kings Cross, London. 
Date/Time: 03 July 2019 / 13.00 - 16:00 


Attending: 
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Kerry Smith (KS) (CHAIR) 


Information Commissioner’s Office (ICO) 


Steve Flack (SF) 


ICO 


Alister Pearson (AP) 


ICO 


Siobhan Woolmer (SW) 


Gambling Commission 


Priya Warner (PW) 


Fundraising Regulator 


Sarah Scott (SS) 


Phone-paid Services Authority 


Rosaleen Hubbard (RH) 


Direct Marketing Commission 


Matt Davidson (MD) 


Charity Commission 


Helen Kibbey (HK) 


Charity Commission 


Tony O'Sullivan (TO) 


Insurance Fraud Bureau 


Gavin Daykin (GD) 


Ofcom 


Madhu Bedhan (MB) 


Ofcom 


Christopher Hall (CH) 


Solicitors Regulation Authority 


Barbara Kubis-Labiak (BKL) 


Financial Conduct Authority 


Greg Williams (GW) 


Financial Conduct Authority 


Richard Clarke (RC) 


National Trading Standards Scams Team 


Alan Tonge (AT) 


Insolvency Service 


Iain Macgregor (IM) 


Insolvency Service 


Apologies: 


Ian Woodham (BT), Carol Doughty (The Pensions Regulator). 
Aim of LINDEN 
To capture and share intelligence effectively and identify, plan, deliver and promote 
coordinated activity to maximise enforcement opportunities against individuals and 
organisations responsible for breaching legislation associated with unsolicited 
marketing texts, live and automated calls and silent or abandoned calls. To protect the 
privacy and consumer rights of individuals and to improve compliance. 
Agenda 

e Introductions (All) 


e ICO Updates - Including a wrap up of reporting; focusing on a six monthly 
update, recovery actions and what we have planned 


e Activity and action update - 5 minute update on relevant activity from each 
organisation, as well as proposed actions for the next quarter. (All) 
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e Ofcom Update - implementation of STIR 
e Operation Linden survey results 
e Week of action - proposals for future proactive work 
e Financial Recovery Unit update 
e Operations update 
e International enforcement update 
e AOB (next meeting / host) 
Introduction 
KS welcomed the attendees. 
ICO Updates provided by KS 
Enforcement 
e Financial year 18/19 
24 penalties issued for breaches of the Privacy and Electronic Communication 
Regulations against companies making or sending calls and messages; for a 


total of £2,208,000. 


CMP breakdown 2018/19: 


Email: 8 - total £379,000 
Live: 12 - total 1,620,000 
Auto: 1 - total £70,000 
SMS: 3 - total £139,000 


e Financial year 2019/20, Quarter 1; 4 penalties issued to date totalling £390,000 
o Smart Home Protection Limited - £90,000 for breaches of Reg 21 
o Avalon Direct Limited - £80,000 for breaches of Reg 21 
o Hall & Hanley - £120,000 for breaches of regulation 21 
o EE Limited - £100,000 for breaches of regulation 22 of the PECR 


Intelligence 


Concerns reported to ICO by type June 2018 - June 2019: 


June 2018 - Live: 5,240; Auto: 4,408; SMS: 1,249 
July - Live: 5,973; Auto: 4,620; SMS: 1,231 
August - Live: 5,337; Auto: 3956; SMS: 1,119 
September - Live: 7,925; Auto: 7,843; SMS: 1,195 
October - Live: 7,547; Auto: 6,980; SMS: 1,245 
November - Live: 6,089; Auto: 5,132; SMS: 1,218 
December - Live: 3,031; Auto: 3,421; SMS: 974 
January - Live: 5,236; Auto: 4,266; SMS: 1,268 
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February — Live: 6,167; Auto: 4,691; SMS: 1,114 
March - Live: 6,775; Auto: 5,461; SMS: 1,318 
April - Live: 4,645; Auto: 5,130; SMS: 1,303 

May - Live: 5,118; Auto: 5,491; SMS: 1,096 

June 2019 - Live: 4,618; Auto: 4,592; SMS: 1,073 


oOo00 0 


Potential reasons for compliant level variation: 


Increase public awareness of the ICO and our enforcement work following the 
implementation of the GDPR and the cold calling ban on claims management 
companies; 

CMPs and other enforcement action receiving widespread and high profile media 
coverage, raising awareness of the online reporting tool. 


Current trends 


Anticipate a dip in the amount of complaints in part due to summer holidays 
Expect to see a continuation of a general increase in complaints as the 
implementation of GDPR continues to raise awareness of individuals’ rights 

Life insurance reviews increasingly prevalent 

Following implementation of cold calling ban for pensions, the ICO has a number 
of investigations in progress. Many calls masquerade as more general marketing 
of financial investments 


Activity & Action Update (ALL) 


Gambling Commission 


The Gambling Commission now has access to 7726 data due to the amendment of the 
non-disclosure agreement between the ICO and the telephone network providers. It is 
forecasted that this will provide a rich new intelligence source and lead to enhanced 
targeted enforcement action. 


Fundraising Regulator 


Operates the Fundraising Preference Service which allows people to control the 
nature and frequency of direct marketing communications that they receive from 
fundraising organisations registered in England, Wales and Northern Ireland. 
Approximately 1,600 charities having at least one suppression list and just over 
28,000 suppressions have been requested. 

List of charities which have failed to suppress contact details is compiled each 
month and referred to the ICO and the Charity Commission. 

They publish a list of charities that have failed to access and action an FPS 
suppression. This list is updated monthly. 


Phone-paid Services Authority 


Beginning work which will look at code 40 and code 50 provisions and are scoping out 
what additional powers these will bring. This is estimated to take one to two years. 
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Digital Marketing Commission 


e Complaints mostly generated from the public, with B2B complaints a minority. 

e Reports about calls are the most popular with email complaints a minority. 

e DMC refers complaints to the ICO or National Trading Standards when they are 
unable to respond. 

e Noted trend of companies relying on aged consent. 


Insurance Fraud Bureau 


e Data vishing continues to be a long standing issue, affecting both insurance 
companies and customers. 

e IFB, in collaboration with the ICO’s criminal investigations team, have taken 
successful enforcement action against companies who used data vishing. 

e Current issue is ‘Google ad-spoofing’; companies spoofing established insurance 
companies. Unsuspecting consumers use the contact number on the advert to 
contact what they think is their insurer, but are in fact lead generators. Leads to 
fraudulent companies obtaining personal data and generating leads. 


Ofcom 


e Continue to evaluate cases for enforcement through analysing Ofcom’s CCT 
complaints data and nuisance calls measurement reports 

e Continue to engage informally with number range holders whose numbers are 
the subject of misuse; powers to withdraw numbers where holders do not take 
effective steps to stop the harm being caused by misuse of their numbers. 

e Established a ‘Do Not Originate’ which they share with providers who are part of 
the strategic working group. (This relates to numbers which would never be used 
by banks on outbound calls, and which can be safely blocked by members of the 
industry working industry.) Ofcom have been working with UK Finance and 
HMRC to promote this list. Continues to engage with a strategic industry working 
group of 10 of the largest communications providers (CPs) to develop and 
implement technical measures to reduce the impact of nuisance calls through 
network-level blocking and call-diverting. Ofcom are continuing to push and 
apply pressure on other CPs to offer customers blocking or diverting facilities. 

e Working with the UKRN; preventing authorised push payment scams strategy. 

Published their Nuisance calls tri-annual tracker research in May 2019. 


Solicitors Regulation Authority 
e Recently agreed a regulatory settlement agreement with Findmyclaims Ltd 


(FMC). FMC sent more than 6 million unsolicited marketing letters between 
November 2016 and September 2017 and fined £124,436. 
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Financial Conduct Authority 


FCA took responsibility of regulation of CMC from CMRU 3 months ago. 

60 companies are winding down following first application window (for 
authorisation) 

Next application window is between 1 June and 31 July 2019; focusing on lead 
generation companies. 

Seeing firms buying companies back books and working on them. 

Postal marketing is a hot topic with firms relying on legitimate interests. 


National Trading Standards Scams Team 


Took joint action with Federal Trade Commission in prosecuting US based mail 
fraudsters who targeted UK victims. $160 Million restrained and subsequently 
forfeited. Largest forfeiture around mail in FTC history. 

Work continues to identify UK based data brokers. 

Roll out of Friends Against Scams enrolment and training; 1m friends to be 
achieved by 2020. Development of friends against scams and scam marshal 
websites. 

Continued feed into NTS and overseas law enforcement agencies to support 
investigations and disruption activity. 

Provision of alert system to mail and telephone providers around upcoming 
identified scams, bogus companies and potential threats to business. 


Insolvency Service 


9,059 cases sifted, which has led to 1,242 disqualifications. The average length 
for a disqualification is 5.5 years. 84 disqualifications were for 10 or more years. 
More companies being defrauded by ‘publishers’ to buy advertising space. 
Increase in companies suffering from other companies cloning, hijacking or 
impersonating them. 

ICO referred call-blocking scam to live investigation teams 


Ofcom - implementation of STIR 


Focusing on tackling spoofing and scams. CPs have been moving customers from 
PSNIs to IPs; IP-based networks are easier to spoof and masking numbers is 
easier. Working with the FTC and the Canadian regulator to establish a way of 
authenticating legitimate numbers; amalgamating all CLIs in a database so they 
can be authenticated. Possible implementation in 2021/22. 


Financial Recovery Unit Update 


Q1 2019/20 four PECR penalties have been issued: two have been appealed and 
two have been paid in full 

2018/19: 

o 5 penalties remain subject to appeal; 

o 10 have been paid (including one PP); 
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o 8 are subject to recovery (five of which are now in liquidation) 
e 2 companies recently wound up: AMS Marketing Ltd & Oaklands Assist UK Ltd 
e Holmes Financial Solutions Ltd; winding up hearing scheduled 10 July 2019 
e FRU will continue to support IP’s investigations. 


Op BOWLER 3 


We are to conduct a proactive ‘mystery shopping’ intelligence gathering exercise aimed 
at identifying organisations seeking to obtain personal data from data subjects and 
where contact or processing may be in breach of PECR/ DPA 2018/GDPR. 


Operation HIDA 


e The ICO currently has an active work stream on data brokers in relation to direct 
marketing. 

e The audits of the six data brokers, which include the three main CRAs, are still 
ongoing. 

e These, as publicly reported, are: Acxiom Ltd, Data Locator Group Ltd, Equifax, 
Experian, GB Group plc and, TransUnion (formerly Callcredit). 


International Enforcement Update 


AP provided an update; the next UCENet meeting is scheduled for October and will be 
hosted in Montreal. The ICO hopes to attend. 


AOB 


e KS confirmed there was no other business and closed the meeting, advising the 
next meeting would be planned for September / October. 
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